Messages in this thread | | | Date | Thu, 24 Mar 2005 21:37:44 +0100 | From | Adrian Bunk <> | Subject | drivers/acpi/video.c: null pointer dereference |
| |
The Coverity checker found the following null pointer dereference in drivers/acpi/video.c:
<-- snip -->
... static int acpi_video_switch_output( ... { ... struct acpi_video_device *dev=NULL; ... list_for_each_safe(node, next, &video->video_device_list) { struct acpi_video_device * dev = container_of(node, struct acpi_video_device, entry); ... } ... switch (event) { case ACPI_VIDEO_NOTIFY_CYCLE: case ACPI_VIDEO_NOTIFY_NEXT_OUTPUT: acpi_video_device_set_state(dev, 0); acpi_video_device_set_state(dev_next, 0x80000001); break; case ACPI_VIDEO_NOTIFY_PREV_OUTPUT: acpi_video_device_set_state(dev, 0); acpi_video_device_set_state(dev_prev, 0x80000001); ...
<-- snip -->
Two different variables of the same name within 40 lines of code are a good indication that something's wrong...
The outer "dev" variable is never assigned any value different from NULL.
acpi_video_device_set_state dereferences this variable.
cu Adrian
--
"Is there not promise of rain?" Ling Tan asked suddenly out of the darkness. There had been need of rain for many days. "Only a promise," Lao Er said. Pearl S. Buck - Dragon Seed
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |